@memoryprocess/mcp 0.0.3-beta.9 → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 JoShMiQueL
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -25,6 +25,11 @@ memoryprocess-mcp [--no-eval] [--help] [--version]
 MEMP_NO_EVAL=1   # same as --no-eval
 ```
 
+`--no-eval` runs **restricted mode**: `eval_js` AND the write tools
+(`mem_write`, `mem_freeze`, `mem_undo`) are hidden from `tools/list` and
+rejected by name -- the model gets a read/describe/scan/pointer/watch
+surface only, nothing that mutates the target.
+
 ## Session model
 
 There is no implicit "current process". `proc_open` returns a session handle
@@ -34,25 +39,27 @@ watches/freezes bound to it.
 
 ## Tools
 
-| Tool                  | Description                                                                                              |
-| --------------------- | -------------------------------------------------------------------------------------------------------- |
-| `proc_list`           | List running processes `{pid,name}[]`                                                                    |
-| `proc_open`           | Open by `{pid}` or `{name}` -> `{session, describe}`. `access:"ro"` = read-only                          |
-| `proc_close`          | Close a session                                                                                          |
-| `mem_describe`        | `Process.describe()`: arch, modules, writable/exec regions, threads                                      |
-| `mem_read`            | Typed read: `i8...i64/u8...u64`, `f32/f64`, `ptr`, `str`, `wstr`, `bytes[:N]` (+`len`)                   |
-| `mem_write`           | Typed write. `dryRun:true` -> `{addr,current,would,bytes}` preview. Journaled                            |
-| `mem_scan`            | CE value scan -> `{hits:[{addr,value}],count,truncated}` (`module`/`start`/`end`/`limit`)                |
-| `mem_scan_next`       | Refine hits: `exact`/`changed`/`unchanged`/`increased`/`decreased`/`increasedBy`/`decreasedBy`/`between` |
-| `mem_pointer_resolve` | `module`+`rva`+`offsets[]` -> resolved address (CE pointer syntax)                                       |
-| `mem_watch`           | Poll an i32 every `ms` -> `{watchId}`; changes accumulate                                                |
-| `mem_watch_poll`      | Drain recorded changes `[{value,ts}]` for a `watchId`                                                    |
-| `mem_unwatch`         | Stop a watch                                                                                             |
-| `mem_freeze`          | Re-write a value every `ms` -> `{freezeId}`                                                              |
-| `mem_unfreeze`        | Stop a freeze                                                                                            |
-| `mem_undo`            | Revert last `n` journaled writes (self-correction primitive)                                             |
-| `mem_journal`         | Write-log snapshot `[{index,addr,bytes}]`                                                                |
-| `eval_js`             | Run JS with `proc` (`Process`) in scope - the escape hatch                                               |
+| Tool                  | Description                                                                                                 |
+| --------------------- | ----------------------------------------------------------------------------------------------------------- |
+| `proc_list`           | List running processes `{pid,name}[]`                                                                       |
+| `proc_open`           | Open by `{pid}` or `{name}` -> `{session, describe}`. `access:"ro"` = read-only                             |
+| `proc_close`          | Close a session                                                                                             |
+| `mem_describe`        | `Process.describe()`: arch, modules, writable/exec regions, threads                                         |
+| `mem_read`            | Typed read: `i8...i64/u8...u64`, `f32/f64`, `ptr`, `str`, `wstr`, `bytes[:N]` (+`len`)                      |
+| `mem_write`           | Typed write. `dryRun:true` -> `{addr,current,would,bytes}` preview. Journaled                               |
+| `mem_scan`            | CE value scan -> `{hits:[{addr,value}],count,truncated}` (`module`/`start`/`end`/`limit`)                   |
+| `mem_scan_next`       | Refine hits: `exact`/`changed`/`unchanged`/`increased`/`decreased`/`increasedBy`/`decreasedBy`/`between`    |
+| `mem_scan_pattern`    | AOB signature scan (`"48 8B ?? 10"`) -> `{hits,count,truncated}` (`module`/`section`/`start`/`end`/`limit`) |
+| `mem_regions`         | VirtualQueryEx region map `{base,size,protect,state,type}` (`writableOnly`/`executableOnly` filters)        |
+| `mem_pointer_resolve` | `module`+`rva`+optional `offsets[]` -> resolved address (CE pointer syntax; no offsets = module base+rva)   |
+| `mem_watch`           | Poll an i32 every `ms` -> `{watchId}`; changes accumulate                                                   |
+| `mem_watch_poll`      | Drain recorded changes `[{value,ts}]` for a `watchId`                                                       |
+| `mem_unwatch`         | Stop a watch                                                                                                |
+| `mem_freeze`          | Re-write a value every `ms` -> `{freezeId}`                                                                 |
+| `mem_unfreeze`        | Stop a freeze                                                                                               |
+| `mem_undo`            | Revert last `n` journaled writes (self-correction primitive)                                                |
+| `mem_journal`         | Write-log snapshot `[{index,addr,bytes}]`                                                                   |
+| `eval_js`             | Run JS with `proc` (`Process`) in scope - the escape hatch                                                  |
 
 ## Wire format (docs/json-conventions.md)
 
@@ -70,5 +77,12 @@ watches/freezes bound to it.
 All writes are journaled -> `mem_journal` + `mem_undo` let an agent preview
 (`dryRun`), commit, inspect, and revert. `eval_js` runs arbitrary JS on the
 host - it's on by default (agents already have code execution) and can be
-disabled with `--no-eval` / `MEMP_NO_EVAL=1`, which omits it from
-`tools/list` entirely.
+disabled with `--no-eval` / `MEMP_NO_EVAL=1`, which is the **restricted
+mode**: `eval_js` and the write tools (`mem_write`, `mem_freeze`,
+`mem_undo`) are omitted from `tools/list` entirely, leaving a
+read/describe/scan/pointer/watch surface that cannot mutate the target.
+
+The coarse tool surface is intentionally narrow: `alloc`, `protect`,
+`injectDll`, thread control, `hook`, `callRemote`, `readMany`/`entity` live
+in `eval_js` by design (escape hatch), and are therefore unreachable under
+`--no-eval` -- that is the point of restricted mode.

package/dist/server.mjs

@@ -414,6 +414,7 @@ const toolDefs = {
 			dryRun: z.boolean().optional().describe("preview only, do not write")
 		},
 		destructive: true,
+		writeOnly: true,
 		handler: (s, a) => {
 			const proc = s.get(a.session);
 			const r = writeTyped(proc, parseAddress(proc, a.addr), a);
@@ -583,7 +584,7 @@ const toolDefs = {
 			...sessionArg,
 			module: z.string().describe("module basename e.g. \"victim.exe\""),
 			rva: z.union([z.string(), z.number()]).describe("offset from module base (hex ok)"),
-			offsets: z.array(z.union([z.string(), z.number()])).describe("pointer-chain offsets; all but the last dereference")
+			offsets: z.array(z.union([z.string(), z.number()])).optional().describe("pointer-chain offsets; omit (or []) for plain module+rva -- no dereference")
 		},
 		handler: (s, a) => {
 			const proc = s.get(a.session);
@@ -595,7 +596,7 @@ const toolDefs = {
 			} catch {
 				throw fail("INVALID_ARGS", `bad rva "${a.rva}"`);
 			}
-			const offsets = a.offsets.map((o, i) => {
+			const offsets = (a.offsets ?? []).map((o, i) => {
 				const n = typeof o === "string" ? Number(BigInt(o)) : Number(o);
 				if (!Number.isFinite(n)) throw fail("INVALID_ARGS", `offsets[${i}] invalid`);
 				return n;
@@ -660,6 +661,7 @@ const toolDefs = {
 			ms: z.number().int().positive().optional()
 		},
 		destructive: true,
+		writeOnly: true,
 		handler: (s, a) => {
 			const proc = s.get(a.session);
 			const addr = parseAddress(proc, a.addr);
@@ -696,6 +698,7 @@ const toolDefs = {
 			n: z.number().int().positive().optional()
 		},
 		destructive: true,
+		writeOnly: true,
 		handler: (s, a) => {
 			return { reverted: s.get(a.session).undo(a.n ?? 1) };
 		}
@@ -725,16 +728,19 @@ const toolDefs = {
 	}
 };
 const TOOL_DEFS = toolDefs;
+/** Tools visible under the given mode. restricted = --no-eval/MEMP_NO_EVAL. */
 function toolNames(opts = {}) {
 	const evalEnabled = opts.evalEnabled ?? true;
-	return Object.keys(toolDefs).filter((n) => evalEnabled || n !== "eval_js");
+	const restricted = opts.restricted ?? false;
+	return Object.keys(toolDefs).filter((n) => (evalEnabled || n !== "eval_js") && (!restricted || !toolDefs[n].writeOnly));
 }
 /** Direct dispatcher used by both the stdio server and the tests. */
 async function callTool(sessions, name, args, opts = {}) {
 	try {
 		const evalEnabled = opts.evalEnabled ?? true;
+		const restricted = opts.restricted ?? false;
 		const def = toolDefs[name];
-		if (!def || name === "eval_js" && !evalEnabled) throw fail("UNKNOWN_TOOL", `unknown tool "${name}"`);
+		if (!def || name === "eval_js" && !evalEnabled || restricted && def.writeOnly) throw fail("UNKNOWN_TOOL", `unknown tool "${name}"`);
 		const parsed = z.object(def.schema).safeParse(args ?? {});
 		if (!parsed.success) {
 			const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
@@ -755,7 +761,8 @@ async function callTool(sessions, name, args, opts = {}) {
 *
 * Usage:
 *   memoryprocess-mcp              # serve MCP over stdio
-*   memoryprocess-mcp --no-eval    # omit the eval_js tool (restricted mode)
+*   memoryprocess-mcp --no-eval    # restricted mode: no eval_js and no write
+*                                  # tools (read/describe/scan/watch/undo only)
 *   memoryprocess-mcp --help       # list tools + exit
 *   memoryprocess-mcp --version
 *
@@ -765,6 +772,7 @@ const dir = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(dir, "..", "package.json"), "utf8"));
 const argv = process.argv.slice(2);
 const evalEnabled = !argv.includes("--no-eval") && process.env.MEMP_NO_EVAL !== "1";
+const restricted = !evalEnabled;
 if (argv.includes("--version") || argv.includes("-v")) {
 	console.log(`${pkg.name} ${pkg.version}`);
 	process.exit(0);
@@ -775,27 +783,37 @@ if (argv.includes("--help") || argv.includes("-h")) {
 	console.log("");
 	console.log("Usage: memoryprocess-mcp [--no-eval] [--help] [--version]");
 	console.log("       MEMP_NO_EVAL=1 is equivalent to --no-eval");
+	console.log("       --no-eval = restricted mode: eval_js AND the write tools");
+	console.log("       (mem_write, mem_freeze, mem_undo) are hidden. Read,");
+	console.log("       describe, regions, scans, pointers and watches remain.");
 	console.log("");
 	console.log("Session model: proc_open returns a handle; every mem_* tool");
 	console.log("takes it as `session`. Writes are journaled (mem_journal) and");
 	console.log("reversible (mem_undo); mem_write supports dryRun previews.");
 	console.log("");
 	console.log("Tools:");
-	const names = toolNames({ evalEnabled });
+	const names = toolNames({
+		evalEnabled,
+		restricted
+	});
 	const width = Math.max(...names.map((n) => n.length));
 	for (const n of names) {
 		const def = TOOL_DEFS[n];
 		console.log(`  ${n.padEnd(width)}  ${def.description}`);
 	}
-	if (!evalEnabled) console.log("\n(eval_js is disabled by --no-eval / MEMP_NO_EVAL=1)");
+	if (restricted) console.log("\n(restricted mode: eval_js and write tools hidden -- read/describe/scan only)");
+	else if (!evalEnabled) console.log("\n(eval_js is disabled by --no-eval / MEMP_NO_EVAL=1)");
 	process.exit(0);
 }
 const sessions = createSessions();
 const server = new McpServer({
 	name: pkg.name,
 	version: pkg.version
-}, { instructions: "Process-memory toolkit. proc_open a target to get a session handle; all mem_* tools take it. Writes are journaled: mem_write with dryRun:true previews, mem_undo reverts. Prefer the coarse tools; eval_js is the escape hatch for anything else." });
-for (const name of toolNames({ evalEnabled })) {
+}, { instructions: "Process-memory toolkit. proc_open a target to get a session handle; all mem_* tools take it. Writes are journaled: mem_write with dryRun:true previews, mem_undo reverts. Prefer the coarse tools; eval_js is the escape hatch for anything else (alloc/inject/threads/hooks/readMany live there by design -- the coarse tool surface stays narrow on purpose). --no-eval runs restricted: read/describe/scan/watch only, no write tools." });
+for (const name of toolNames({
+	evalEnabled,
+	restricted
+})) {
 	const def = TOOL_DEFS[name];
 	server.registerTool(name, {
 		description: def.description,
@@ -805,7 +823,10 @@ for (const name of toolNames({ evalEnabled })) {
 			destructiveHint: def.destructive === true
 		}
 	}, async (args) => {
-		const result = await callTool(sessions, name, args, { evalEnabled });
+		const result = await callTool(sessions, name, args, {
+			evalEnabled,
+			restricted
+		});
 		const data = result.ok === true ? result.data !== null && typeof result.data === "object" && !Array.isArray(result.data) ? result.data : { result: result.data } : void 0;
 		return {
 			content: [{
@@ -828,5 +849,8 @@ process.on("SIGINT", shutdown);
 process.on("SIGTERM", shutdown);
 const transport = new StdioServerTransport();
 await server.connect(transport);
-process.stderr.write(`${pkg.name} ${pkg.version} ready on stdio (${toolNames({ evalEnabled }).length} tools${evalEnabled ? "" : ", eval_js disabled"})\n`);
+process.stderr.write(`${pkg.name} ${pkg.version} ready on stdio (${toolNames({
+	evalEnabled,
+	restricted
+}).length} tools${restricted ? ", restricted: no eval/write" : ""})\n`);
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memoryprocess/mcp",
-  "version": "0.0.3-beta.9",
+  "version": "1.0.0",
   "description": "MCP server exposing the memoryprocess toolkit to LLM agents - the primary agentic surface.",
   "type": "module",
   "packageManager": "bun@1.4.4",
@@ -11,7 +11,9 @@
     ".": "./dist/server.mjs"
   },
   "files": [
-    "dist"
+    "dist",
+    "LICENSE",
+    "README.md"
   ],
   "os": [
     "win32"
@@ -45,7 +47,7 @@
     "agent"
   ],
   "dependencies": {
-    "@memoryprocess/core": "^0.0.3-beta.9",
+    "@memoryprocess/core":"^0.1.0-beta.0",
     "@modelcontextprotocol/sdk": "^1.32.2",
     "zod": "^4.6.7"
   },